ScanMalware plugin
Investigate phishing and malicious URLs with ScanMalware from
Claude Code, Codex and Gemini CLI. ScanMalware renders URLs in a sandboxed browser and keeps
every public scan in a searchable archive. This plugin connects your agent to that archive
and teaches it how to turn one phishing URL into the rest of its campaign.
No account or API key is needed.
What it adds
-
The ScanMalware MCP server (https://mcp.scanmalware.com/mcp, remote, no sign-in):
128 tools, 126 of them read-only. Read a scan's verdict, network requests, IOCs, TLS and
JARM details, detected technologies, YARA matches, OCR text and RDAP data; find related
scans by domain, IP, ASN, JARM, favicon hash, screenshot hash, TLSH/ssdeep/sdhash fuzzy
hash, OCR text, tracking key or JavaScript fingerprint; look up Certificate Transparency
records; submit a new URL for scanning. The two write tools submit a URL for scanning and
vote on a scan as safe or malicious.
-
The skill pivoting-phishing-infrastructure-with-scanmalware: a procedure for
expanding one phishing URL into its sibling hosts, and for avoiding the two mistakes that
produce wrong conclusions:
- giving a domain a verdict that belongs to someone else: a lure that only redirected to
it (common for the brands phishing kits imitate), or another tenant's subdomain on a
shared platform such as
github.io or pages.dev;
- blocking on a pivot that describes a hosting platform rather than an actor (shared
IPs, ASNs and JARM fingerprints).
Besides kit artifacts (script hashes, inline scripts included, favicon, screenshot,
title), it pivots on the operator's own account keys, such as an analytics ID or a
live-chat license in the page source, which follow the operator across kit rebuilds and
hosting platforms. It includes scripts/agent.py (Python standard library only), whose
related subcommand turns the pivots into a host list, and a report template.
Install
Claude Code
/plugin marketplace add scanmalware/scanmalware-plugin
/plugin install scanmalware@scanmalware
The skill appears as scanmalware:pivoting-phishing-infrastructure-with-scanmalware.
Codex
codex plugin marketplace add scanmalware/scanmalware-plugin
codex plugin add scanmalware@scanmalware
Gemini CLI
gemini extensions install https://github.com/scanmalware/scanmalware-plugin
Only the MCP server
In Claude, ScanMalware is also listed in the connectors directory. Any MCP client can
connect to https://mcp.scanmalware.com/mcp over streamable HTTP without credentials.
What this plugin sends, and where
- MCP tool calls go to
mcp.scanmalware.com, run by Triop AB. Each call sends its
arguments (URLs, domains, IP addresses, hashes, scan IDs) there, and the server forwards
them to the ScanMalware API at scanmalware.com. Requests are logged as described in the
MCP server privacy policy.
- The skill's commands and
scripts/agent.py call the ScanMalware REST API at
https://scanmalware.com/api/v1 directly, anonymously. They send the URLs, domains and
hashes you investigate, and no credentials.
- Submitting a URL makes ScanMalware's scanner visit it, which the site's operator can
see. A
public scan lists the URL and its results in the public feed, visible to anyone
and to search engines; an unlisted scan is reachable only through its link; a private
scan needs a ScanMalware account. The MCP submit_scan tool requires you to choose; the
REST API uses public when the choice is left out. Use unlisted for client targets and
anything carrying a victim's email address or token.
- The plugin runs no hooks, installs no packages and reads no environment variables.
ScanMalware's own terms and privacy policy: https://scanmalware.com/terms,
https://scanmalware.com/privacy.
Support
Questions and bug reports: GitHub issues
or https://scanmalware.com/contact. The MCP server's source is at
scanmalware/mcp-server.
License
Apache-2.0. ScanMalware is operated by Triop AB, Sweden.
